Privacy Policy

1. Who We Are

NLS Nile Corporation (“we”, “us”) is a plant hire, haulage and site-equipment company based in Nairobi, Kenya, and is the data controller for personal information submitted through this website. For any privacy question or request, contact us via the details on our contact page, marking your message “Privacy”.

2. Information We Collect

Enquiries and hire requests: your name, company, phone number, email address, and the job details you give us (equipment needed, site location, dates and scope). Shop orders: your name, phone number, optional email address, delivery details, and the items ordered. Payment records: the M-Pesa receipt number, amount, date/time and the phone number that paid, as confirmed to us by Safaricom. Technical data: our servers keep standard logs (including IP address, time and pages/API calls requested) for security and rate-limiting; your browser stores your theme preference and shopping cart locally on your own device (see section 8). We do not run third-party advertising trackers on this site.

3. Lawful Basis and How We Use It

We process your information under the Kenya Data Protection Act, 2019 on these bases: to take steps at your request before, and to perform, a contract (quotes, hires, orders, delivery and invoicing); to comply with legal obligations (tax and accounting records); for our legitimate interests (operating and securing this website, preventing payment fraud and prompt abuse, and keeping business records); and, where we ever ask separately, with your consent (e.g. marketing). We do not sell personal information, and we do not use it for automated decision-making that produces legal effects.

4. Payment Information

M-Pesa payments are processed by Safaricom. You approve payment by entering your M-Pesa PIN on your own phone in response to a prompt we initiate through Safaricom’s Daraja API. We never receive, see or store your M-Pesa PIN, and no card details are collected anywhere on this site. We retain the transaction confirmation Safaricom sends us (receipt number, amount, time and payer phone number) as our proof of payment and for reconciliation and tax records.

5. Who We Share It With

Only where needed to run the service: Safaricom (to request and confirm M-Pesa payments); transport and courier providers (delivery name, phone and address); our hosting/IT providers (to operate this website and its API); our accountants and professional advisers; and public authorities where we are legally required to (e.g. a court order or tax audit). Order tracking on this site deliberately shows only a masked phone number and requires either your one-time tracking link or the exact phone number used at checkout.

6. Retention

General enquiries are kept for up to two years. Hire, order and payment records are kept for at least five years to meet Kenyan tax record-keeping requirements, and may be kept longer where an account relationship continues or a dispute is outstanding. Server and security logs are kept for a shorter period proportionate to security needs. When information is no longer needed it is deleted or anonymised.

7. Your Rights

Under the Data Protection Act, 2019 you may request: confirmation of what personal information we hold about you and a copy of it; correction of inaccurate information; deletion where we no longer have a lawful basis to keep it; objection to, or restriction of, processing; and portability of information you provided, where applicable. Contact us using section 1 — we may ask for proof of identity and will respond within the statutory timelines. If you believe we have mishandled your information you may complain to the Office of the Data Protection Commissioner (ODPC) in Kenya.

8. Cookies and Local Storage

This site does not set advertising or analytics cookies. It stores two items in your browser’s local storage: your light/dark theme preference (key: theme) and your shopping cart contents (key: nls_cart_v1); checkout additionally keeps short-lived session items (an idempotency key and your pending order number) so a refresh or double-click cannot create a duplicate order. Clearing your browser storage removes all of these; the site remains usable without them except that your cart will empty.

9. Security

We use HTTPS for the website and API in production, keep payment credentials server-side only, verify every payment against Safaricom’s confirmation and the order amount before fulfilling, store order-tracking tokens only as hashes, and rate-limit order lookups and payment prompts to prevent abuse. No system is perfectly secure; if we become aware of a personal-data breach that risks your rights we will notify the ODPC and affected individuals as required by law.

10. Changes to This Policy

We may update this policy as our services or the law change. The current version is the one published on this page, and the “last updated” date above shows when it last changed. Material changes affecting existing customers will be drawn to their attention by email or on this site.